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About this Article
==================

This article on Simplex locks was originally published in 2600
magazine, Volume 8, Number 3 (Autumn, 1991).  This electronic form
has created for those people that do not have access to 2600 magazine
(or have never heard of it!).  I HIGHLY suggest that you subscribe --
It's worth your while to support this magazine.  A yearly home
delivered subscription is $21 for an individual, $50 for a corporate
subscription.  Overseas it's $40 individual, $65 corporate.  You can
reach 2600 on the net by writing mail to: 2600@well.sf.ca.us.
Subscription Correspondence can be sent to:

2600 Subscription Dept.
P.O. Box 752
Middle Island, NY
                  11953-0099

This is NOT the article in its entirety.  I left out parts that I
felt were not of dire need, such as quotes from Simplex personel,
locksmiths, and Federal Express and other non-essentail information.  
A few sentences have been reworded, and corrections have been made
that were pointed out in the next issue (Winter 1991/1992).

Here it is..  Share the knowledge.

-Magic
magic@atdt.org


Some Background on Simplex Locks
================================

No lock is one hundred percent secure.  As any locksmith will tell
you, even the best lock can be opened if one wishes to invest the time
and resources.  However, a good lock should at least be secure enough
to prevent the average person from compromising it.  Common sense
dictates that a lock which can easily be opened by anyone is simply
not a safe lock to use.  

While an average person may not have the necessary skills and
expertise to use a lock pick or a blowtorch, almost everyone has the
ability to count, and the ability to cound is all that is necessary
to compromise a Unican/Simplex pushbutton lock.  In addition, one
needn't count very high.  Only 1081 combinations are used, and in
most cases this number is reduced considerably.  

Although Simplex claims that "thousands of combinations are
available," in truth only 1081 combinations are used.  Another 1081
combinations are available in the guise of "high security half-step
codes."  These are codes which require the user to push one or more
buttons only halfway.  Because of the extreme difficulty in setting
and using these half-step codes, Simplex advises against their use,
and in most cases, does not even inform the user that these codes are
available.  Naturally, the addition of 1081 combinations does not
make the lock considerably more secure.  (If 2162 combinations seems
like a large number, consider that a $5 Master lock has 64,000.)

It has been found that nuberous organizations use Simplex locks as a
primary lock source.  Among the guilty parties in the New York
metropolitan area are Federal Express, United Parcel Service (UPS),
Citicorp Center, John F. Kennedy International Airport, and the State
University of New York at Stony Brook.  Others around the nation
include General Motors, the State Department, McDonald's, NSA, and
the University of Wisconsin.

The biggest offender is Federal Express, which uses Simplex locks on
over 25,000 dropboxes nationally.  The dropboxes are particularly
insecure because Federal Express uses the same combination for all of
their dropboxes in every state on the east coast!  So by opening one
dropbox, we now have access to thousands.  

Access was also gained to a UPS dropbox -- in one shot.  UPS did not
even bother to change the default combination which is set by
Simplex.  And, just like Federal Express, UPS figures that a single
combination is good enough for every dropbox.  


Hacking Simplex Locks
=====================

What follows is a list of all possible combinations for Simplex
locks.  They have been divided into four groups acording to how many
pushbuttons are used.  Listed after each group name is the total
number of combinations in the group.  The numbers listed in
parentheses refer to pushbuttons that must be pressed together.  If
you find that none of the combinations appear to open the lock, then
it may be a rare instance of a half-step code.  In this case, only
the last number (or numbers if they are in parentheses) should be
pressed in HALFWAY and held while the knob or latch is turned.
Slowly press in the pushbutton(s) until you feel pressure.  If you
hear a click then you have pushed the buttons in too far.  If all of
this sounds complicated, then you are beginning to understand why it
is that Simplex does not recommend the use of half-step codes, and
subsequently why half-step codes are virtually never used.

Simplex locks come in many different shapes, sizes, and colors.
However, the two models that you will most likely see are the 900 and
the 1000 series.  The characteristic features of the 900 series are
five black buttons spaced in a circular fashion on a round, metallic
cylinder.  In addition, the 900 series utilizes a latch instead of a
doorknob.  The 1000 series is much larger, with five (usually
metallic) pushbuttons spaced vertically on a rectangular metal
chassis.  Unlike the 900 series, the 1000 has a doorknob.

It is suggested that novices attempt their first hack on a Simplex
900 model.  If the latch is located below the buttons, then the
procedure is as follows:  1) turn the latch counterclockwise to reset
the lock;  2) enter a combination from the list;  3) turn the latch
clockwise to open.  If the latch is located above the buttons then
simply reverse this procedure.  Make sure that you reset the lock
after each try.

To hack a 1000 model, simply enter a combination from the list and
turn the knob clockwise.  You will hear clicks as you turn the knob,
indicating that the lock has been reset.  It is sometimes difficult
to tell when you have cracked a 1000 model by simply turning the
knob.  When you do get the correct code, you will hear a distinctive
click and feel less pressure as you turn the knob.  

You will find that turning the latch on a 900 model requires less
wrist motion and makes much less noise than turning the knob on a
1000 model.  These details seem trivial until you realize that you
may have to turn the latch or doorknob a few hundred times before you
crack the lock.

It can not be stressed enough how much easier it is when you know the
range.  For instance, if you know that only three digits are being
used, then you do not have to waste time trying four digits.  One way
to find out the range is to stand nearby while someone punches in the
code.  You will hear distinctive clicks which will give you an idea
of the range.  If you cannot stand nearby then try hiding a voice
activated tape recorder near the door.  The tape recorder will remain
off until someone comes up to punch in the code.  You can then
retrieve the recorder later at your convenience and listen for the
telltale clicks.  It was found that this method only works in quiet
areas, such as the inside of a building.  Another way to find out the
range is to take a pencil eraser and carefully rub off a tiny bit of
rubber on each of the pushbuttons.  When someone comes to enter the
combination, they will rub off the rubber on all of the pushbuttons
that they use, while leaving telltale traces of rubber on the
pushbuttons that they do not use.  This method works particularly
well because you eliminate pushbuttons, which drastically reduces the
number of combinations that must be tried.  

It has been found that certain ranges tend to be used more than
others.  Group B (three pushbuttons) tends to be used in "low
security areas," while Groups C and D tend to be used in areas which
seem like they should be more secure.  A lock which uses a
combination from Group A has never been found.  For some reason, the
1000 series mostly uses Group C (four pushbuttons).  In addition,
most combiniations tend to be "doubles," which require at least two
of the pushbuttons to be pressed together.  When you decide on a
particular range to start with, try the doubles first.  For instance,
try "(12)345" before you try "12345."  A lock which uses a triple,
quadruple, or all five pushbuttons pressed at the same time has never
been found.

Although a list of all the possible combinations is provided, you may
find it useful to invest some time and record these codes onto
cassette.  This makes it much easier for one person to hack a Simplex
lock.  A walkman looks far less conspicuous than sheets of paper
filled with numbers.  

Finally, it is always good to take a few lucky shots before
initiating a brute force hack.  Always try the default combination
"(24)3" before trying anything else.  Above all, DON'T give up!
Even if you do not get the combination in ten minutes, you are still
that much closer to figuring it out.  It is recommended that you do
not stress yourself out trying every combination in one shot.  A few
minutes a day will do just fine, and the thrill of achievement will
be well worth the wait.


Changing Combinations on the 900 Series
=======================================

You may change combinations to any sequence you wish, using any or
all buttons, in any order, separately or pushed at the same time with
other buttons.  You cannot use the same button more than once in a
combination.  

1)  With the door OPEN and the Simplex LOCKED, turn the FRONT CONTROL
KNOB (marked "Simplex") to the LEFT, and RELEASE.  Push the EXISTING
combination and RELEASE the buttons.

2)  Remove the screw in the Lock Housing with an Allen wrench.
Insert the wrench into the screw hole and depress button within.
Remove wrench.

3)  Turn the front control knob (marked "Simplex") to the LEFT, and
RELEASE. 

4)  Press the buttons in the sequence desired for your new
combination.  Record your new combination.

5)  Turn the front control knob RIGHT.  Your new combination is now
installed.  Before shutting the door, try it to be sure you have
recorded it correctly.  Replace the threaded screw in the Lock
Housing.  

NOTE:  If the front control knob opens the lock without pushing the
combination, steps 3, 4, and 5 were performed out of order and your
Simplex is in a "0" combination.  To reinstall a combination, follow
the above steps above, but omit step #1.


All possible Simplex Combinations
=================================
Note: Numbers in parentheses should be pressed together

GROUP A:    GROUP B:    423         (34)5       (234)       2354
35          130         425         (35)1       (235)       2413
                        431         (35)2       (245)       2415
1           123         432         (35)4       (345)       2431
2           124         435         (45)1                   2435
3           125         451         (45)2       GROUP C:    2451
4           132         452         (45)3       375         2453
5           134         453         3(12)                   2513
12          135         512         4(12)       1234        2514
13          142         513         5(12)       1235        2531
14          143         514         2(13)       1243        2534
15          145         521         4(13)       1245        2541
21          152         523         5(13)       1253        2543
23          153         524         2(14)       1254        3124
24          154         531         3(14)       1324        3125
25          213         532         5(14)       1325        3142
31          214         534         2(15)       1342        3145
32          215         541         3(15)       1345        3152
34          231         542         4(15)       1352        3154
35          234         543         1(23)       1354        3214
41          235         (12)3       4(23)       1423        3215
42          241         (12)4       5(23)       1425        3241
43          243         (12)5       1(24)       1432        3245
45          245         (13)2       3(24)       1435        3251
51          251         (13)4       5(24)       1452        3254
52          253         (13)5       1(25)       1453        3412
53          254         (14)2       3(25)       1523        3415
54          312         (14)3       4(25)       1524        3421
(12)        314         (14)5       1(34)       1532        3425
(13)        315         (15)2       2(34)       1534        3451
(14)        321         (15)3       5(34)       1542        3452
(15)        324         (15)4       1(35)       1543        3512
(23)        325         (23)1       2(35)       2134        3514
(24)        341         (23)4       4(35)       2135        3521
(25)        342         (23)5       1(45)       2143        3524
(34)        345         (24)1       2(45)       2145        3541
(35)        351         (24)3       3(45)       2153        3542
(45)        352         (24)5       (123)       2154        4123
            354         (25)1       (124)       2314        4125
            412         (25)3       (125)       2315        4132
            413         (25)4       (134)       2341        4135
            415         (34)1       (135)       2345        4152
            421         (34)2       (145)       2351        4153


4213        (12)54      (35)41      3(25)4      41(23)      (23)(15)
4215        (13)24      (35)42      4(25)1      45(23)      (23)(45)
4231        (13)25      (45)12      4(25)3      51(23)      (24)(13)
4235        (13)42      (45)13      1(34)2      54(23)      (24)(15)
4251        (13)45      (45)21      1(34)5      13(24)      (24)(35)
4253        (13)52      (45)23      2(34)1      15(24)      (25)(13)
4312        (13)54      (45)31      2(34)5      31(24)      (25)(14)
4315        (14)23      (45)32      5(34)1      35(24)      (25)(34)
4321        (14)25      3(12)4      5(34)2      51(24)      (34)(12)
4325        (14)32      3(12)5      1(35)2      53(24)      (34)(15)
4351        (14)35      4(12)3      1(35)4      13(25)      (34)(25)
4352        (14)52      4(12)5      2(35)1      14(25)      (35)(12)
4512        (14)53      5(12)3      2(35)4      31(25)      (35)(14)
4513        (15)23      5(12)4      4(35)1      34(25)      (35)(24)
4521        (15)24      2(13)4      4(35)2      41(25)      (45)(12)
4523        (15)32      2(13)5      1(45)2      43(25)      (45)(13)
4531        (15)34      4(13)2      1(45)3      12(34)      (45)(23)
4532        (15)42      4(13)5      2(45)1      15(34)      (123)4
5123        (15)43      5(13)2      2(45)3      21(34)      (123)5
5124        (23)14      5(13)4      3(45)1      25(34)      (124)3
5132        (23)15      2(14)3      3(45)2      51(34)      (124)5
5134        (23)41      2(14)5      34(12)      52(34)      (125)3
5142        (23)45      3(14)2      35(12)      12(35)      (125)4
5143        (23)51      3(14)5      43(12)      14(35)      (134)2
5213        (23)54      5(14)2      45(12)      21(35)      (134)5
5214        (24)13      5(14)3      53(12)      24(35)      (135)2
5231        (24)15      2(15)3      54(12)      41(35)      (135)4
5234        (24)31      2(15)4      24(13)      42(35)      (145)2
5241        (24)35      3(15)2      25(13)      12(45)      (145)3
5243        (24)51      3(15)4      42(13)      13(45)      (234)1
5312        (24)53      4(15)2      45(13)      21(45)      (234)5
5314        (25)13      4(15)3      52(13)      23(45)      (235)1
5321        (25)14      1(23)4      54(13)      31(45)      (235)4
5324        (25)31      1(23)5      23(14)      32(45)      (245)1
5341        (25)34      4(23)1      25(14)      (12)(34)    (245)3
5342        (25)41      4(23)5      32(14)      (12)(35)    (345)1
5412        (25)43      5(23)1      35(14)      (12)(45)    (345)2
5413        (34)12      5(23)4      52(14)      (13)(24)    4(123)
5421        (34)15      1(24)3      53(14)      (13)(25)    5(123)
5423        (34)21      1(24)5      23(15)      (13)(45)    3(124)
5431        (34)25      3(24)1      24(15)      (14)(23)    5(124)
5432        (34)51      3(24)5      32(15)      (14)(25)    3(125)
(12)34      (34)52      5(24)1      34(15)      (14)(35)    4(125)
(12)35      (35)12      5(24)3      42(15)      (15)(23)    2(134)
(12)43      (35)14      1(25)3      43(15)      (15)(24)    5(134)
(12)45      (35)21      1(25)4      14(23)      (15)(34)    2(135)
(12)53      (35)24      3(25)1      15(23)      (23)(14)    4(135)



2(145)      21534       41325       (12)435     (35)142     1(25)34
3(145)      21543       41523       (12)453     (35)214     1(25)43
1(234)      23451       41532       (12)534     (35)241     3(25)14
5(234)      23415       42315       (12)543     (35)412     3(25)41
1(245)      23514       42351       (13)245     (35)421     4(25)13
4(235)      23541       42513       (13)254     (45)123     4(25)31
1(245)      23145       42531       (13)425     (45)132     1(34)25
3(245)      23154       42135       (13)452     (45)213     1(34)52
1(345)      24513       42153       (13)524     (45)231     2(34)15
2(345)      24531       43512       (13)542     (45)312     2(34)51
(1234)      24135       43521       (14)235     (45)321     5(34)12
(1235)      24153       43125       (14)253     3(12)45     5(34)21
(1245)      24351       43152       (14)325     3(12)54     1(35)24
(1345)      24315       43215       (14)352     4(12)35     1(35)42
(2345)      25134       43251       (14)523     4(12)53     2(35)14
            25143       45123       (14)532     5(12)34     2(35)41
GROUP D:    25341       45132       (15)234     5(12)43     4(35)12
541         25314       45213       (15)243     2(13)45     4(35)21
            25413       45231       (15)324     2(13)54     1(45)23
12345       25431       45312       (15)342     4(13)25     1(45)32
12354       31245       45321       (15)423     4(13)52     2(45)13
12453       31254       51234       (15)432     5(13)24     2(45)31
12435       31452       51243       (23)145     5(13)42     3(45)12
12534       31425       51324       (23)154     2(14)35     3(45)21
12543       31524       51342       (23)415     2(14)53     34(12)5
13452       31542       51423       (23)451     3(14)25     35(12)4
13425       32451       51432       (23)514     3(14)52     43(12)5
13524       32415       52314       (23)541     5(14)23     45(12)3
13542       32514       52341       (24)135     5(14)32     53(12)4
13245       32541       52413       (24)153     2(15)34     54(12)3
13254       32145       52431       (24)315     2(15)43     24(13)5
14523       32154       52134       (24)351     3(15)24     25(13)4
14532       34512       52143       (24)513     3(15)42     42(13)5
14235       34521       53412       (24)531     4(15)23     45(13)2
14253       34125       53421       (25)134     4(15)32     52(13)4
14352       34152       53124       (25)143     1(23)45     54(13)2
14325       34251       53142       (25)314     1(23)54     23(14)5
15234       34215       53214       (25)341     4(23)15     25(14)3
15243       35124       53241       (25)413     4(23)51     32(14)5
15342       35142       54123       (25)431     5(23)14     35(14)2
15324       35241       54132       (34)125     5(23)41     52(14)3
15423       35214       54213       (34)152     1(24)35     53(14)2
15432       35412       54231       (34)215     1(24)53     23(15)4
21345       35421       54312       (34)251     3(24)15     24(15)3
21354       41235       54321       (34)512     3(24)51     32(15)4
21453       41253       (12)345     (34)521     5(24)13     34(15)2
21435       41352       (12)354     (35)124     5(24)31     42(15)3


43(15)2      524(13)      231(45)     (23)1(45)   (123)54      24(135)
14(23)5      542(13)      312(45)     (24)5(13)   (124)35      42(135)
15(23)4      235(14)      321(45)     (24)3(15)   (124)53      23(145)
41(23)5      253(14)      (12)(34)5   (24)1(35)   (125)34      32(145)
45(23)1      325(14)      (12)(35)4   (25)4(13)   (125)43      15(234)
51(23)4      352(14)      (12)(45)3   (25)3(14)   (134)25      51(234)
54(23)1      523(14)      (13)(24)5   (25)1(34)   (134)52      14(235)
13(24)5      532(14)      (13)(25)4   (34)5(12)   (135)24      41(235)
15(24)3      234(15)      (13)(45)2   (34)2(15)   (135)42      13(245)
31(24)5      243(15)      (14)(23)5   (34)1(25)   (145)23      31(245)
35(24)1      324(15)      (14)(25)3   (35)4(12)   (145)32      12(345)
51(24)3      342(15)      (14)(35)2   (35)2(14)   (234)51      21(345)
53(24)1      423(15)      (15)(23)4   (35)1(24)   (234)15      (123)(45)
13(25)4      432(15)      (15)(24)3   (45)3(12)   (235)14      (124)(35)
14(25)3      145(23)      (15)(34)2   (45)2(13)   (235)41      (125)(34)
31(25)4      154(23)      (23)(14)5   (45)1(23)   (245)13      (134)(25)
34(25)1      415(23)      (23)(15)4   3(12)(45)   (245)31      (135)(24)
41(25)3      451(23)      (23)(45)1   4(12)(35)   (345)12      (145)(23)
43(25)1      514(23)      (24)(13)5   5(12)(34)   (345)21      (234)(15)
12(34)5      541(23)      (24)(15)3   2(13)(45)   4(123)5      (235)(14)
15(34)2      135(24)      (24)(35)1   4(13)(25)   5(123)4      (245)(13)
21(34)5      153(24)      (25)(13)4   5(13)(24)   3(124)5      (345)(12)
25(34)1      315(24)      (25)(14)3   2(14)(35)   5(124)3      (45)(123)
51(34)2      351(24)      (25)(34)1   3(14)(25)   3(125)4      (35)(124)
52(34)1      513(24)      (34)(12)5   5(14)(23)   4(125)3      (34)(125)
12(35)4      531(24)      (34)(15)2   2(15)(34)   2(134)5      (25)(134)
14(35)2      134(25)      (34)(25)1   3(15)(24)   5(134)2      (24)(135)
21(35)4      143(25)      (35)(12)4   4(15)(23)   2(135)4      (23)(145)
24(35)1      314(25)      (35)(14)2   4(23)(45)   4(135)2      (15)(234)
41(35)2      341(25)      (35)(24)1   4(23)(15)   2(145)3      (14)(235)
42(35)1      413(25)      (45)(12)3   5(23)(14)   3(145)2      (13)(245)
13(45)2      431(25)      (45)(13)2   1(24)(35)   1(234)5      (12)(345)
12(45)3      125(34)      (45)(23)1   3(24)(15)   5(234)1      (1234)5
21(45)3      152(34)      (12)5(34)   5(24)(13)   1(235)4      (1235)4
23(45)1      215(34)      (12)4(35)   1(25)(34)   4(235)1      (1245)3
31(45)2      251(34)      (12)3(45)   3(25)(14)   1(245)3      (1345)2
32(45)1      512(34)      (13)5(24)   4(25)(13)   3(245)1      (2345)1
345(12)      521(34)      (13)4(25)   1(34)(25)   1(345)2      5(1234)
354(12)      124(35)      (13)2(45)   2(34)(15)   2(345)1      4(1235)
435(12)      142(35)      (14)5(23)   5(34)(12)   45(123)      3(1245)
453(12)      214(35)      (14)3(25)   1(35)(24)   54(123)      2(1345)
534(12)      241(35)      (14)2(35)   2(35)(14)   35(124)      1(2345)
543(12)      412(35)      (15)4(23)   4(35)(12)   53(124)      (12345)
245(13)      421(35)      (15)3(24)   1(45)(23)   34(125) 
254(13)      123(45)      (15)2(34)   2(45)(13)   43(125)
425(13)      132(45)      (23)5(14)   3(45)(12)   25(134)
452(13)      213(45)      (23)4(15)   (123)45     52(134)



The following is a list of all combinations for Simplex locks - the kind 
Federal Express uses to "secure" items put in drop boxes.  These locks can
usually be broken into in under 10 minutes, if you know what you're doing.
This list was taken from the alt.security newsgroup in Internet Netnews.

                                                --DecimatoR
                                              PHALCON-SKISM 1992
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1       2
1       2       3
1       2       3       4
1       2       3       4       5
1       2       3       4&5
1       2       3       5
1       2       3       5       4
1       2       3&4
1       2       3&4     5
1       2       3&4&5
1       2       3&5
1       2       3&5     4
1       2       4
1       2       4       3
1       2       4       3       5
1       2       4       3&5
1       2       4       5
1       2       4       5       3
1       2       4&5
1       2       4&5     3
1       2       5
1       2       5       3
1       2       5       3       4
1       2       5       3&4
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